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Quantum physics allows for unconditionally secure communication through insecure communication chan¬ 
nels. The achievable rates of quantum-secured communication are fundamentally limited by the laws of quantum 
physics and in particular by the properties of entanglement. For a lossy communication line, this implies that 
the secret-key generation rate vanishes at least exponentially with the communication distance. We show that 
this fundamental limitation can be violated in a realistic scenario where the eavesdropper can store quantum 
information for only a finite, yet arbitrarily long, time. We consider communication through a lossy bononic 
channel (modeling linear loss in optical fibers) and we show that it is in principle possible to achieve a constant 
rate of key generation of one bit per optical mode over arbitrarily long communication distances. 

PACS numbers: 03.67.Dd, 03.65.-w, 03.67.Hk 


I. INTRODUCTION 

Quantum key distribution (QKD) promises uncondi¬ 
tional secure communication through insecure communica¬ 
tion channels Oil- In real world implementations of QKD, 
however, the achievable secret-key rates are still relatively low 
compared with standard telecommunication rates. The rates 
of secret-key generation are not only constrained by exper¬ 
imental imperfections, which can be amended in principle, 
but are also limited by the fundamental features of quantum 
physics. As recently shown in 0 ], the entanglement between 
the two ends of the communication channel ultimately bounds 
the maximum rate of secret-key generation: 

R < E sq (A 0 , (1) 

where E sq (Af) is an entropic quantity called the squashed en¬ 
tanglement of the channel 0], which is function of the quan¬ 
tum communication channel AT linking the legitimate sender 
Alice to the legitimate receiver Bob. 

In this paper we consider the case where the communication 
channel AT is a lossy (and noisy) bosonic channel. This means 
that information is encoded in a collection of bosonic modes 
whose corresponding canonical operators are denoted a,j, at 

and satisfy the commutation relations [a,j> , at] = 6jj>. In 
the Heisenberg picture the quantum channel maps the canon¬ 
ical operators ay, at to ay —> y/rjuj + \/l — rjVj, a] —> 
y/fja] + y/1 — r] vj, where rj £ [0,1] is the attenuation factor 

(also called transmissivity) and Vj, vj are the canonical ladder 
operators of an environment bosonic mode. The lossy channel 
is obtained if the environment mode is initially in the vacuum 
state, while the lossy and noisy channel corresponds to the en¬ 
vironment mode being in a thermal state with Np mean pho¬ 
ton number. These channels attenuate the input power by a 
factor 77 and model the ubiquitous processes of linear absorp¬ 
tion and scattering of light. 

When applied to the case of the lossy bosonic channel, the 
squashed entanglement bound in £[]) yields 0: 

R<!og(}± 7 ), (2) 


where the rate is measured in bits (throughout this paper 
log = log 2 ) per bosonic mode (given the bandwidth of the 
channel, this can be easily translated in bits per second). For 
both free space and fiber optics communication, the attenua¬ 
tion factor r] = e~ t R° scales exponentially with the distance 
£ between sender and receiver, where the characteristic length 
£0 depends on experimental conditions. For long distances, 
R < 2r] = 2e~ i R°, and the key rate decays at least expo¬ 
nentially with increasing communication distance. This result 
marks a striking difference between quantum-secured com¬ 
munication and (insecure) classical communication. In the 
latter case, one can in principle achieve a finite communica¬ 
tion rate over arbitrarily long distances, just by sufficiently 
increasing the signal power [ 3 ]. Unfortunately, this is not 
the case for quantum communication where a fundamental 
rate-distance tradeoff exists, requiring the use of quantum re¬ 
peaters to perform QKD on long distances. 

It is thus clear that to go around the fundamental rate- 
distance tradeoff in (0 one should renounce unconditionally 
security. Here we discuss QKD conditioned on the assump¬ 
tion that technological limitations allow an eavesdropper Eve 
to store quantum information reliably only for a known and 
finite - but otherwise arbitrarily long - time. Such an eaves¬ 
dropper may also have unlimited computational power, in¬ 
cluding a quantum computer. Indeed, any physical realization 
of a quantum memory can reliably store quantum information 
only for a time of the order of its coherence time. We stress 
that we do not require the legitimate receiver to have better 
quantum storage technologies than the eavesdropper. As will 
be shown, the legitimate parties could have a much shorter 
memory time than the eavesdropper and the communication 
will still be secure. 


H. SECURITY DEFINITIONS 

According to the state of the art, one requires a quantum 
cryptography protocol to be unconditionally and composably 
secure. Unconditional security means that one does not rely 
on unproven statements (e.g, about the complexity of factor¬ 
izing large numbers, or in general about the computational 
power of the eavesdropper). Composable security means that 
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the given protocol is secure also when used as a subroutine 
within an overarching protocol H. 

Suppose that a given communication protocol aims at es¬ 
tablishing a secret message described as a random variable 
X. The information about X in the hands of the eavesdrop¬ 
per Eve is described, without loss of generality, by a bipartite 
quantum state of the form 

Pxe = y ^Px{x) \x){x\ <g) p E { x) . (3) 

X 

Ideally, one would like Eve’s state to be completely uncorre¬ 
lated with the message X , that is, pxe = Px ® Pe 01 - To 
quantify the deviation from such an ideal setting one considers 
the trace distance 0 ] 

D(pxe , Px ® Pe) '•= y || Pxe — Px ® Pe\\i • (4) 

Therefore, the security of the communication protocol is as¬ 
sessed by the condition 

D(pxe, Px ® Pe) < e, (5) 

which implies that the state pxe is indistinguishable, up to a 
probability smaller than e, from the state px 0 p E , that is, the 
given communication protocol is secure up to a probability 
smaller than e @]. As a matter of fact this criterion guarantees 
unconditional and composable security d. 

In this paper we renounce unconditional security and seek 
security conditioned on the fact that the eavesdropper can 
store quantum information only for a finite and known time r. 
This means that Eve is forced to make a measurement within 
a time r after obtaining the quantum state. Suppose that Eve 
has made a measurement A described by the POVM (positive 
operator valued measurement) elements {A y } y Hi- After the 
measurement has been made, the state has ‘collapsed’ to 

Pxe = ^2 Tic e(pxe^ i Si A y )\y) E {y\ (6) 

V 

= ^2px(x)Ti (pe(x) Ay) |z)(x| 0 \y)s{y\ ■ (7) 

x,y 

Since p' XE is diagonal in the basis {|x) (g) |y)}, we have 
d (p'xe,Px® Pe) = \Pxr(x,y) - p x (x)p Y (y)\ (8) 

x,y 

=■■ D(pxy,PxPy) , (9) 

where p XY (x,y) = Px{x)p Y \ x {y) with p Y \ x (y) = 
Tr(p E (x)A y ) and p Y (y) = J 2 x Px(x)p Y \ x {y), that is, the 
trace distance equals the distance between classical probabil¬ 
ities. Finally, optimizing over Eve’s choice of her measure¬ 
ment, we obtain the following security condition: 

sup D(pxy,PxPy) < e. (10) 

A 

In this paper, instead of working directly with condition 
dm we require 

(id 


where / acc ( X : E) p denotes the accessible information of Eve 
about A' given the state pxe 03 - The latter implies condition 
( 1 1 0 | ). for e = -y /2 In ( 2 ) e', via Pinsker inequality PHl 

max D(pxy,PxPy) < J 2 In (2) / acc (A; E) p . (12) 

A * 

It is worth recalling that accessible information was used as 
a security quantifier during the first years of quantum cryptog¬ 
raphy, since it was found that a security criterion based on the 
accessible information does not in general guarantee compos- 
able security in an unconditional manner [ 8 |]. Here instead we 
have shown that composability holds under condition ( ITOt if 
we give up full unconditional security and seek security un¬ 
der the assumption that the eavesdropper can store quantum 
information only for a finite and known time — i.e, she has a 
quantum memory with limited storage time. 


III. SUMMARY OF THE RESULTS 

We present two novel key-generation protocols for 
continuous-variable quantum optical communication through 
a lossy bosonic channel with transmissivity p, modeling linear 
attenuation and scattering. These protocols are composably 
secure under the condition that Eve’s as a quantum memory 
with finite, and known, but otherwise arbitrarily long, storage 
time. 

The first protocol is a direct-reconciliation protocol (in 
which we allow information reconciliation by forward pub¬ 
lic communication from the sender Alice to the receiver Bob). 
We obtain a simple formula for the asymptotic key rate (see 

FigH): 

r dr = 1 + log 

This protocol can generate a nonzero key rate for any p > 1 / 3 . 
By comparison, the maximum unconditionally secure key rate 
from direct reconciliation is given by the quantum capacity 

formula log ) El and is positive only for p > 1/2 El- 

The second protocol is a reverse-reconciliation protocol 
(we allow information reconciliation by backward public 
communication from Bob to Alice). In this setting we show 
that Alice and Bob can in principle generate key at an asymp¬ 
totic rate of more than 1 bit per bosonic mode sent through 
the channel. This is true for any nonzero value of the trans¬ 
missivity p , provided sufficient input energy is provided — 
hence reproducing the feature of insecure classical communi¬ 
cation in a quantum-secured communication framework. The 
achievable asymptotic key rate is (see Fig. 0 

r TT = 1 + log ■ ( 14 ) 

By comparison, the maximum fully unconditional key rate is 
upper bounded by the expression in (0 and vanishes as 2 p for 
small values of p. 


Iacc{X; E) p < e', 
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FIG. 1: Achievable key rate for the pure loss channel ( Nt = 0) vs 
the channel transmissivity 77 , in bits per mode, for direct reconcilia¬ 
tion protocols. Blue solid line: Achievable locked-key rate as given 
by the expression in d 1 3b . Red dashed line: Maximum fully uncondi¬ 
tional secret-key rate, given by the expression max{ 0 , log ( )} 

d- 

Gr 



FIG. 2: Achievable key rate for the pure loss channel (Nt = 0) vs 
the channel transmissivity 77 , in bits per mode, for reverse reconcili¬ 
ation protocols. Blue solid line: Achievable locked-key rate as from 
the expression in CE3- Red dashed line: Upper bound for the secret- 
key rate (assisted by two-way public communication), given by the 
expression in G}. Yellow dash-dotted line: Achievable asymptotic 
secret-key rate according to the standard security definition as given 
by the reverse coherence information log ) US. 


We also consider the case of lossy and noisy bosonic chan¬ 
nel, which models the presence of experimental imperfec¬ 
tion or a thermal-like background with Nt mean photons per 
mode. The lossy and noisy channel is also used to model an 
‘active attack’ from the eavesdropper, who injects noise in the 
channel. In this case we obtain an asymptotic rate equal to 

r rr = 1 +log - 9( n t) , (15) 

which is nonzero at arbitrary distances provided Nt < 0.3 
(see Fig. [3]) 

These protocols are instances of quantum data locking pro¬ 
tocols (see Sec.[V}. We henceforth call locked key a key which 
is generated by a quantum data locking protocol, just to re¬ 
mind us that this key is not unconditionally secure, but secure 
conditioned on the assumption of finite memory storage time. 


FIG. 3: Tolerable excess noise Nt vs the transmissivity 77 for the 
reverse-reconciliation quantum data locking protocol, from Eq. G3- 
The asymptotic locked-key generation rate is nonzero for values of 
( 77 , Nt) below the curve. 


IV. COMPARISON WITH OTHER MODELS 

It is known that high rates of secret-key generation can be 
attained against an eavesdropper endowed with an imperfect 
quantum memory, as for example in the Bounded Storage 
Model, where Eve can store only a constrained number of 
qubits (see e.g. id). Even under bounded storage, no known 
protocol attains a constant rate as a function of distance. Else¬ 
where we have shown that quantum data locking allows for 
a substantial enhancement of the key rate fig . fl7tl . Here we 
show for the first time that such an assumption allows us to 
generate key at a constant rate across virtually any distance. It 
is an open question whether the quantum data locking could 
be applied in the bounded storage model to attain rates of key 
generation independent on the distance. 

Our results must be compared with the bounds on the opti¬ 
mal secret-key rate obtained requiring fully unconditional se¬ 
curity. In the asymptotic setting, the security is usually quan¬ 
tified by the quantum mutual information (see e.g. flST ). The 
gain in key generation rate that we achieve follows from the 
existence of a large gap between the quantum mutual infor¬ 
mation and the accessible information of the adversary. This 
gap is well known in quantum information theory: it is the 
quantum discord d, which quantifies the quantum correla¬ 
tions that the adversary cannot access by local measurements 
on her share of the quantum system. 


V. QUANTUM DATA LOCKING AND QUANTUM ENIGMA 
MACHINES 

In a typical quantum data locking protocol l2(il - (23tl . the two 
legitimate parties, say Alice and Bob, publicly agree on a set 
of MK quantum codewords. They then use a preshared se¬ 
cret key of log K bits, labeled by s = 1, 2,..., K, to secretly 
agree on a set of M (equally probable) codewords, labeled by 
x = 1,2,..., M, used to encode log M bits of classical infor¬ 
mation. These quantum codewords are sent through n uses of 
a quantum channel from Alice to Bob. Suppose an eavesdrop¬ 
per Eve tampers with the communication line and obtains one 
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of the states s). The correlations between Eve’s quan¬ 

tum system and the input message x are described by the state 

M K 

PXE = mJ2\ X )( X \ ® (16 ) 

X— 1 S—1 

where {| x)} x =i,...,m is an orthonormal basis for an auxiliary 
quantum system encoding the messages x — notice that the 
summation over s comes from the fact that Eve does not know 
the value of the secret key. One can prove that, if the states 
Pe(x, s) have a suitable form and for K large enough. Eve can 
only obtain a negligible amount of the classical information — 
as quantified by the accessible information — carried by the 
label x. 

In the most powerful quantum data locking schemes known 
up to now, a constant-size preshared secret seed of about 
log I\ = log 1/e bits allows Alice and Bob to encrypt log M 
bits (with M arbitrarily large), with the guarantee that Eve’s 
accessible information is of the order of e log M bits j24l - l26}l . 

It is worth remarking that quantum data locking provides 
a strongest violations of classical information theory in the 
quantum setting. Indeed, according to a famous theorem of 
Shannon’s, which assesses the security of one-time pad en¬ 
cryption, to encrypt m bits of classical information Alice and 
Bob need at least m bits of preshared secret key {21}. Quan¬ 
tum data locking violates this Shannon’s result by an expo¬ 
nential amount. 

A quantum data locking protocol can be seen as a quantum 
counterpart of the twentieth century Enigma machine [28!]. 
Following ll28l(29tl we call ‘quantum enigma machine’ an op¬ 
tical cipher that harnesses the quantum data locking effect. 

A. Quantum bootstrapping 

The first works on quantum data locking only considered 
the ideal case of a noiseless communication scenario. Only 
recently the quantum data locking effect has been considered 
in a noisy setting | [28l - [30ll (see also JH). Here we combine 
quantum data locking with a key-recycling technique that has 
been successfully applied to quantum data locking in a noisy 
communication scenario 11611201 . 13211 . 

We assume that eavesdropper Eve and the legitimate re¬ 
ceiver can store quantum information for a time te and tb, 
respectively. 

Suppose then that Alice and Bob, using the quantum chan¬ 
nel n times, run a quantum data locking protocol to commu¬ 
nicate logM = nx bits of classical information, and con¬ 
sume log A' = nk bits of preshared secret key. Bob may 
need to perform a collective measurement over n quantum 
systems in order to decode. Since, as from our assumption, 
Bob’s quantum memory can store quantum information only 
for times shorter than tb, this requires that the n quantum 
signals should be sent within this time interval (this is always 
possible for tb large enough or by increasing the repetition 
rate). 

On the other hand, if Eve has a quantum memory with fi¬ 
nite coherence time te , this implies that she is forced to mea¬ 


sure within a time te after receiving the signals, otherwise 
her memory will decohere anyway. Therefore, what the legit¬ 
imate parties Alice and Bob can do is to wait for a time longer 
than te before sending more information through the channel. 
After waiting such a time, Alice and Bob can safely recycle 
part of the obtained key as a fresh key to run another round of 
quantum data locking. 

Thus, for x > k, Alice and Bob can recycle part of the 
newly established key and use it as a seed for another round 
of quantum data locking. By repeating this procedure many 
times they will asymptotically obtain a overall locked-key rate 
of r - x ~ k bits per channel use, with a negligible amount 
of initially shared secret key. 

While r = x ~ k is the rate of bits per channel use, one 
could expect a lower rate in terms of bits per second, due 
to the waiting times between quantum data locking subrou¬ 
tines. There is a simple strategy to solve this problem: Alice 
and Bob can use the dead times to run two (or more) inde¬ 
pendent quantum data locking protocols. In this way they 
can in principle achieve a rate of bits per second as high as 
rv = (x ~~ k)v, where v is the number of channel uses per 
second. Notice that this holds for any value of te, as long as 
it is known to Alice and Bob, and independently of tb (for 
instance we can take tb = te or even tb < te). 

VL THE DIRECT RECONCILIATION PROTOCOL 

Alice prepares multimode coherent states that encode both 
the input message x £ {1 ,,M} and the value of the secret 
seeds s £ {1,..., K} she shares with Bob. The encoding is 
by a random code (whose codebook is public) that assigns to 
each pair (x, s ) an n-mode coherent states 

n 

|a”(a;,s)) = (g) |ay(x,s )), (17) 

j=i 

where ay (x, s) is the amplitude of the coherent state of 
the j-th bosonic mode sent through the channel. This is 
schematically depicted in Fig. [4] where the lossty channel 
is represented as a beam-plitter. To construct the random 
code, the amplitudes of the coherent states are independently 
drawn from a circularly symmetric Gaussian distribution, de¬ 
noted G(o,jv), with zero mean and mean photon number 
f d 2 a \a\ 2 G(o,N) = N. 

The receiver Bob obtains the attenuated coherent states 

n 

\\/va n (x, s)) = (^) \y/rjatj(x, s )). (18) 

j =i 

The goal of Bob, who knows the value of s, is to decode x. It 
is known that he can do that (with asymptotically negligible 
error) with an asymptotic bit-rate for x given by 0] 

Xdr := lim l ° gM = g(rjN) , (19) 

n—> oo 77, 

where 


g(N) = (IV + 1) log (N + 1) — N log N. (20) 
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FIG. 4: The lossy bosonic channel can be modeled as a beam-splitter 
with transmissivity g and the environment mode initially in the vac¬ 
uum state. In the direct reconciliation protocol, Alice sends coherent 
state down the channel. 


To guarantee the security of the communication protocol, 
we have to bound Eve’s accessible information. For any x 
and s. Eve obtains the attenuated coherent states 


covariance matrix Vabe (whose explicit form is given in the 
Appendix). 

In the second phase of the communication protocol. Bob 
makes a collective measurement on his share of n bosonic 
modes, described by the state p^ = Pg n , where ps is a Gaus¬ 
sian state with zero mean and variance Vb (see Appendix 
for details). Indeed, Bob applies a measurement T(s) cho¬ 
sen from a set of measurements parameterized by the label 
s = 1 ,K. The value of s is determined by the secret 
key he shares with Alice. That is, while the list of possible K 
measurement is public and hence known to Eve, the specific 
choice of T(s) is known only by Alice and Bob. 

Bob’s measurement is debited as follows. First, Alice and 
Bob publicly agree on a set of MK n-mode coherent states 

n 

\P n (x,s)) = (g)\p j ( X ,s)), (27) 

3 =1 


\\/T^r)a n {x, s)) = (^) \y/l^rjaj(x, s)). ( 21 ) 

3 =1 

We can show (see Sec. IV 11 lb that Eve’s accessible information 
about Alice’s input message x is negligibly small, provided 
Alice and Bob initially share enough bits of secret key. For N 
large enough, and asymptotically in n, this is achieved for 

log K 

k dl := lint - = 2g[{l - rj)N} - g[ 2(1 - 77 ) iV] . (22) 

n—> 00 ti 

Applying the key-bootstrapping routine (see Sec. IV Al l. this 
yields a net asymptotic locked-key generation rate of 

fdr = Xdr - fcdr = g(V N ) ~ 2 ff[(l “ V)N] + g[ 2(1 - 77 ) IV] , 

(23) 

which in the limit of N —> oo becomes 

fdr = 1 + log ' ( 24 ) 


VII. THE REVERSE RECONCILIATION PROTOCOL 

In the brst phase of the protocol Alice prepares n instances 
of a two-mode squeezed vacuum state, with N mean photons 
per mode, that is, Paa' = Paa 1 w ith 

PAA’ = |Ca ? '}aa / {Cn | (25) 


and 


1 °° / N \ (/2 

ICn)aa ' = Wtt^ 0 \ ¥TJ ^ K)aK)a '’ (26) 

where \l) denotes the photon-number state with i photons. Al¬ 
ice keeps the modes labeled with ‘A’ and sends through n uses 
of a lossy bosonic channel those labeled with ‘A'’, see Fig. [5] 
At the end of this brst phase of the communication protocol, 
Alice, Bob and Eve share the 3n-mode state Pabe = Pabe » 
where pabe is a 3-mode Gaussian state with zero mean and 


for x = 1 ,,M and s = 1 ,,K. These coherent states 
are debited by sampling the amplitudes (3j(x,s ) i.i.d. from 
a circularly symmetric Gaussian distribution with zero mean 
and variance r/N. For any given s, we consider the sliced 
operator 


M 

£(s) = E P B s)){^(x, s)\P n B , (28) 

31 = 1 

where IP)', is the projector on the strongly (5-typical subspace 
debned by pf s n (see, e.g. Il3~3ll). Applying the operator Cher- 
noff bound (see Appendix for details) we obtain that the 
bounds 


(1 - e)M2~ n9 ^P n B < £(s) < (1 + e)M2~ n9 ^P n B 

(29) 

hold true with arbitrarily high probability provided M 3V 
2 n s(vN). j t f 0 n ows that for any given s the operators 


^ p n B \p n (x,s))(p n (x,s)\n 

' (1 + e)M2~ n a(v N ) 


(30) 


debne a subnormalized POVM in Bob’s typical subspace, 
which can be completed by introducing the operator To(s) = 
Pg — In this way we have debned Bob’s mea¬ 

surement r(s) for all values of s. After performing the mea¬ 
surement, Bob declares an error if he obtains the measurement 
output corresponding to To(s). This event, however, happens 
with a negligible probability (see Appendix for details). 

In the third phase of the protocol, Alice makes a mea¬ 
surement on her share of bosonic modes. For a given value 
of s (which is known to Alice and Bob) and x, we con¬ 
sider Alice’s conditional state p\{x, s ). As a matter of fact, 
Bob’s measurement induces a virtual backward communica¬ 
tion channel from Bob to Alice. As a result, for given s, Al¬ 
ice obtains an ensemble of states {p^x, s),p(x, s)}a;=i,...,iw, 
where p(x, s) = Tr(r s (s)yOg(s)). The maximum amount of 
classical information (per mode) about x that Alice can ex¬ 
tract from this ensemble of states is given, in the asymptotic 
setting, by the associated Holevo information j 34j] 125]: 



S(Pa) ^ s ) S (Pa( x i s )) 


(31) 
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FIG. 5: The lossy bosonic channel can be modeled as a beam-splitter 
with transmissivity g and the environment mode initially in the vac¬ 
uum state. In the first phase of the reverse reconciliation protocol, 
Alice sends one mode of a two-mode entangled state (denoted by the 
symbol ‘oo’) down the channel. 


VIII. SECURITY PROOFS 


We discuss in details the case of the lossy channel. The 
proof for the lossy and noisy channel can be obtained in a 
similar way. 

The starting point of the proof are some mathematical 
tools presented in [17|- There we assumed that Eve’s states 
Pe(x, s ) belongs to a finite-dimensional space of dimension 
d n . Given the bipartite state 

1 M 1 K 

Pxe = J^^2 \ x )( x \®kJ2 p e( x ’ s )’ ( 38 ) 

X—l S=1 


where S(p) = —Tr(plogp) denotes the von Neumann en¬ 
tropy. From the explicit expressions forp(:r, s), p\(x, s ) and 
p\\ (given in the Appendix) we obtain 

Xrr = 9(N)~g[(l-ri)N'} (32) 


where N' = N/( 1 + 77 N). % rr also quantifies the rate (in 
bits per mode) of shared randomness that can be established, 
with the assistance of public communication, by Alice and 
Bob iH. 

Finally, to show the security of the communication proto¬ 
col, we need to bound Eve’s accessible information about x. 
Bob’s measurement also induces a virtual quantum channel 
to Eve. For any given s, the ensemble of states obtained by 
Eve is {pe(x, s),p{x, s)} x =i,...,m, where p%(x,s) is Eve’s 
state conditioned on Bob’s measurement result x. Given the 
explicit form of p^(x, s ) we show (see Sec. lVIIll and the Ap¬ 
pendix) that Eve’s accessible information about x is negligibly 
small for I\ such that 


fcrr := lim 


log A' 


(33) 


= 2 5 [(1 - n)N] - <?[(! - r))N'] - <?[(! - rj)N "], (34) 


the following bound hold for the associated accessible infor¬ 
mation (see [ 17]): 


4cc < log M 


where 


d n 

m T« 1 H[m] ~ * 


' M 

_x=l 



Qx (</>) = (01 P n E(x,s)\<j>), (40) 

S=1 

H[Q{4>)} = with r]( ■ ) = — (•) log (•). 

The minimum is over all vectors </> in Eve’s (("-dimensional 
Hilbert space. 

As shown in id, if the ensemble of states from which the 
codewords are sampled is such that for any unit vector \<p), 

p := ¥. s [{4>\p%{x, s)|</>)] = (41) 

(E s denotes the expectation value over s), and 

E:= E^lpKx^sM 2 } 

= E s [(</>, (j>\ pe{x, s ) (8) Pe{x, s)|(/>, 4 ))] , (42) 


with N" = N(1 + 2pN)/(l + r/N). In conclusion, applying 
the bootstrapping routine, we obtain a net rate of locked-key 
generation of (in bits per mode) 

hr = Xrr-fcrr = N) - 2g [(1 — 7?) TV] +g [(1 — T]) N"] , ( 35 ) 
which in the limit of N —> oo reads 


(here |</>, </>) = |</>) ® | <j>)) then the right hand side of d39l) is 
smaller than e log M provided that 


K > max 27 " 

with 


1 , ,, 2,5 

In M + In - 
e z e J e 


d n 4 In 2 In d" 

M ^ 


(43) 


r rr = 1 + log ■ ( 36 ) 

Similar results are obtained if the channel from Alice to 
Bob is lossy and noisy. In this case the reverse reconciliation 
protocol achieves an asymptotic locked-key rate of 

r rr = 1 + log ^ - 9( n t) , (37) 


7 " = 4 ' ( 44 > 

p 2 

In our setting n counts the number of modes employed in 
one quantum data locking routine. Putting M = 2" x and 
e = e~ n with c £ (0,1), condition (l43l > yields an asymptotic 
rate of secret-key consumption (in bits per mode) 

k = lim — log K = max {log 7 , logd — \} • (45) 

n—>■ oo 77, 


where Nt is the mean number of thermal photons per mode In our continuous-variable setting. Eve’s space is infinite- 
in the channel. dimensional. Therefore, to apply the result of ijT^] we need to 
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map Eve’s space into a finite dimensional one. In both the di¬ 
rect and reverse reconciliation protocol, the expectation value 
over s of the state of Eve has the form (see details in the Ap¬ 
pendix) 

p n E =E s [p n E (x,s)\=p% n , (46) 

that is, the average state is a direct product. In particular, p E is 
a Gaussian state with zero mean, variance V E , and mean pho¬ 
ton number (1 — rf)N. We can hence consider the 5-typical 
subspace projector P” associated with p 0 ". We use this pro¬ 
jector to define an auxiliary bipartite state of the form 

1 M 1 K 

a XE = l^l ® K J2 a E( X ’ S )’ ( 47 ) 

X—l S=1 

where 

a^(x,s)=¥ n pP ^(x,s)V n p (48) 

is obtained by slicing with the (5-typical subspace projector. 
From the properties of the typical projector we have 

\Wxe ~ PxeWi < ^ ■ (49) 

Since the two states are 5-close in trace-norm, the security 
of the state p\ E follows, up to a probability 5, from that of 
cr'x e- I n suc h a way we have reduced the problem to a finite 
dimensional one, where the dimension is that of the 5-typical 
subspace, i.e., 

d n -pr (P n ) £ p ra [ s (P-E)-ci5]^ 2 ra [‘ s '(PE)+ ci ]j ( 50 ) 

(for some constant c). 

We use a notion of typical subspace that is a slightly dif¬ 
ferent from the one usually considered (see for instance [33:]). 
Given a hermitian operator £ we consider its spectral decom¬ 
position 

£ = J>^, (51) 

i 

where the sum is over the eigenvalues pi and the correspond¬ 
ing eigenprojectors Pi , in such a way that pi ^ pi* for i ^ £' 
(that is, Tr (Pi) equals the degeneracy of pi). We look at each 
projector Pi as an event whose probability is ni = pi Tr (Pi). 
Given £® n , we then define the 5-typical projector P" as (we 
omit the subscript 5 to simplify the notation) 

P ?= 5Z Pi 1 ®Pt 3 ®“-®P tn (52) 

PtiPt 2 ---Pi„^ T s 

where the sum is over the sequences p^pi 2 ■ ■ -pi n which are 
5-typical with respect to the probability distribution iri. No¬ 
tice that this construction of the typical projector coincides 
with the usual one when all the eigenvalues of £ are non de¬ 
generate. 

First we compute (1411 : 

ti = E s [{(j)\a%(x,s)\(t>}] (53) 

= e s mf; p n E(x,s)v;m (54) 

= mp ( 55 ) 


Then, from the equipartition properties of the 5-typical sub¬ 
space we have (for some constant c) 

2~n[S(p E )+cS] < < 2-™['S r 0 >s)-c< 5 ] _ (55) 

To compute (l42l > we need to introduce another typical sub¬ 
space projector. We consider the state (pe 0 p E )® n and its 
associated (25)-typical subspace projector, denoted as P"^ . 
Notice that [P p ® P p , P p0p ] = 0, and that P" 0 P” < P p(glp . 
We also consider the state 

P2E ■= E s[p n E (x , s) (8) p%(x, s)] = p®E ■ (57) 

By explicit computation (see Appendix) we can show that, 
in both the direct and reverse reconciliation protocols, pi e is 
a Gaussian state with zero mean and covariance matrix V2 E - 
Moreover, p 2 E commutes with p E ® Pe since they are both 
diagonal in the photon-number basis (see Appendix). It fol¬ 
lows that p 2 E also commutes with P plg , . We also have that, 
given that pe has mean photon number (1 — rj)N, then both 
P 2 e and pE 0 pe have 2(1 — rf)N mean photons. 

We can now compute (1421) : 

E = E s [(0,0| a E (x,s) 0 a E (x,s) WA)} (58) 

= W, <t>\ Pp ® 2 Pe(x, s) ® Pe(x, s) P” 02 |0,0)] (59) 
= (0,0|P^ 2 p®"P^ 2 |0,0). (60) 

Since P” 02 commutes with P p(glp and P p 02 < P p(8p , we have 

S < (0, 0| P"gi p pf E Pp®p 10! 0) ■ (61) 

To conclude, let us consider the sliced operator 
K®pP®E P p®p- Since [^®p,P®e} = 0 we can apply a 
classical argument concerning typical type classes (see, e.g., 
JH). Let us denote as qi the eigenvalues of p 2 E- We notice 
that the eigenvectors of P p ® p P®e P ”®p are those of p® E 
which are in the range of P(that is, they are 5-typical for 
(pe 0 Pe ) 0n ). Consider then an eigenvector whose 5-typical 
type is 7 f, the corresponding eigenvalue of P p( g, p pf E P p®p i s 

w = qf l = 2 n ^ ^ log . (62) 

1 

Being p 2 E a zero-mean, thermal-like, Gaussian state, qi = 
Z~ 1 2~ l3e , where £ is the photon number. This yields 


yj = 2- n (P( e )*+ l0 S Z ) 

(63) 

_ 2~n(P2(l-Ti)N+\og Z+f)A{t)) 

(64) 

_ 2~ rl ('S(p2E)+/3A{^)) 

(65) 


Here (£)% = 7 xgl is the mean photon number given by the 

5-typical distribution n. Since ff is 5-typical for (pe 0 Pe)® 11 , 
we expect (£)% = 2(1 — p)N, A(£) = (£)# — 2(1 — rj)N 
being the fluctuation about the expectation value. Finally we 
have used S(p 2 e) = /32(1 — r/)N + log Z. In the Appendix 
we show that, for a 5-typical type n, 

|0A(£)| < 2c5[(l — r/)N + 1] 


( 66 ) 
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(for some constant c), from which we obtain 


and hence 


w < 2 _ "(‘ s ( p2E i +2c<5 [( 1_?) i JV+1 li , 

(67) 

£ < 2—"(■S'(P 2 J5;)-l-2c<5[( 1 —T 7 )JV-(-l]) 

(68) 


From these results, in the limits that n —> oo and S —> 0, 
we obtain the following bound on the key consumption rate: 


k = max{2S(p E ) - S(p 2 e),S(pe) - x} ■ (69) 


For the direct reconciliation protocol we have (see deriva¬ 
tion in Appendix): X = sMQ, S(p E ) = g{{ 1 - V)N), and 
S(p 2 e) = < 7 ( 2(1 — r])N). For any given 77 > 0 and N large 
enough we then obtain 

k = 2 S{p E )-S{p 2E ) = 2g[(l-r 1 )N]-g[2(l-r l )N \. (70) 

For the reverse reconciliation protocol we have (see Ap¬ 
pendix) % = g(N) — <j(( 1 — t})N'), with N’ = N/(l + 77 N), 
S{pe) = g{{l-r])N), and S(p 2E ) = g(( l-r})N') + g((l- 
rj)N"), with N" = N( 1 + 2gN)/{l + 77 TV). For any given 
77 > 0 and N large enough we then obtain 

k = 2S(p E ) ~ S( P 2 e ) (71) 

= 2 fl [(l - r])N] - g[{ 1 - 77 )N’] - g[( 1 - 77 )N"] . (72) 


IX. CONCLUSION 

Quantum cryptography promises unconditionally secure 
communication through insecure communication channels. 
However, fundamental properties of quantum entanglement 
bound the ultimate secret-key generation rates that can be 
achieved through a communication channel For the rele¬ 
vant case of a lossy communication line, as e.g. free-space of 
fiber optics communication, the bound of J2l implies that the 
secret-key generation rate must decrease at least exponentially 
with increasing communication distance. 

Here we have analyzed the rate-distance tradeoff under the 
realistic assumption that one can store quantum information 
reliably only for a finite time. Clearly, any quantum mem¬ 
ory device can store quantum information only for a time of 
the order of its coherence time. We have shown that for any 
given finite, yet arbitrarily long, storage time, the quantum 
data locking effect can be applied to generate key at a constant 
rate over arbitrarily long distances through an optical channel 
with linear loss. Moreover, we have shown that this result 
holds also in the presence of moderate noise or experimental 
imperfections modeled as a thermal background. 

It remains an open problem to show that these high rates 
of key generation can be achieved in practice. One major 
problem is to find a decoding measurement that can be exper¬ 
imentally realized with current technologies and still allows 
us to achieve a constant key rate over long communication 
distances. If this question will find a positive answer, our re¬ 
sults could pave the way to a new family of QKD protocols 
that yield a constant key rate that does not decay with increas¬ 
ing communication distance. This would also imply that long 
distance quantum communication can be in principle realized 
without employing quantum repeaters. 
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Appendix A: The direct reconciliation protocol 


In the direct reconciliation protocol, the 77-mode codewords 
obtained by Eve read 

Pe(x,s) = |v/l - ga n (x,s))(^l-ga n (x,s)\, (Al) 

where \y/\ — r/a n (x, s)) = ®"_ 1 |- V /T7 ~rj a, (x, s)) is a 77- 

mode coherent state, where the amplitudes ctj (x, s)’s are sam¬ 
pled i.i.d. from a circularly symmetric Gaussian distribution 
G(q,n) = 2 nN e ~^ ! N zero mean and variance N. 

Therefore the expectation value over s of p^{x, s ) reads 


E, 


( !• _ _ \ ®n 

J dp,\y/l-rja){y/l -T)a\j (A2) 


= P% n - 


(A3) 


where dp = (i 2 aG(o.Ar)(o:), and p E is a single-mode ther¬ 
mal state with mean photon number (1 — 77 )N. The spectral 
decomposition of p E is 


Pe = 


(1-77)JV+1^ \(l-rt)N + l 


E 


im (A4) 


where \t) is the /'-photon state. The von Neumann entropy of 
Pe is 


S\p E ) = g((l-g)N). (A5) 

Therefore, denoting as Pj' the h-tvpical projector associated 
with p we have (for some constant c) (see e.g. lt33ll ) 

2 n [g((i-v)N)-c 5 ] < < 2 n I £ '(( 1-?7 ) Ar ) +c ' 5 l (A6) 


and 


2 -n [9(( 1-? 7) iV )+ c ' 5 ]p" < P" p” P" 


< 2 - "[9(( 1-I b Ar ) -c ' 5 ]p" 

(A7) 


Consider the operator p® 2 . This is a two-mode thermal 
state with 2(1 — ri)N mean photons. Its spectral decompo¬ 
sition can be obtained from (IA4b : 


_V v ( J2-W-Y Pl 

- 7 l)N+lJ ^ o \(l~r,)N + l) 

(A8) 

where Pi denotes the projector on the subspace with £ pho¬ 
tons. The (-photon subspace is generated by the £ + 1 
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two-mode vectors {10)|€), |1)|£ — 1),...|f}|0)}, therefore 
Tr ( / ’.} =1+1. 

Let us now consider the expectation value over s of the op¬ 
erator p%{x, s) ® p%(x, s ): 


^s[Pe{x,s)® p%(x,s)] = 

JdpWl - r]a){\/l - pa\ ® |y/l - 1 - 77a| 


0n 


= p?*- 


(A9) 

(A10) 


where P^ is the projector on Bob’s typical subspace. For any 
given s, we have a collection {£(2;, s)} x= ;l m of M i.i.d. 
operator-valued random variables, with £(x, s) < P'/>, and 
E[£(x, a)] > 2 _n [ 9 ( I?iV ) +c ‘ 5 ]Pg. Hence by restricting to Bob’s 
typical subspace, we meet the conditions for applying the op¬ 
erator Chernoff bound with a = 2~ n ^ g( ' vN ' )+c5 \ It follows 
from (IB II) that for any s, the operator 

M 

Z(s) = J2n\r( x ,s))(f3 n (x, s )I V n B (B4) 

X — l 


The state p 2 E is a Gaussian state with zero mean and 2(1 — 
rj)N mean photons. Its spectral decomposition is: 


P2E = 


where 


1 A/ 2(! — rj)N y 

2(1 — ri)N + 1 “ \2(1 — rj)N + 1/ 


(All) 


I Vv + > = 



i) . 


(A12) 


From this we compute the von Neumann entropy of p 2 E- 


satisfies E(s) < M( 1 + e )2 -ri [ s ( ?7Ar ) +c ' 5 lp^ with arbitrary 
high probability if M 3> 2 _ "[ 9 ( I?Ar ) +cl5 ]. This in turn implies 
that the operators 


P n B \/3 n (x, S ))(/3 n (x,s)\F n B 

' (1 -f e')M2- n ^{ri N )+c6] 


(B5) 


define a subnormalized POVM, that is, )C 7: r x (s) < I (here 
the identity is intended as the identity operator in the typical 
subspace). 

To complete the subnormalized POVM we introduce the 
operator 


S(j>2E)=g(2(l-v)N). (A13) 

Finally, since \ipg) is a f-photon state, we obtain that P 2 E com¬ 
mutes with pe®Pe , which also implies that [pf B , Pp^p] = 0. 

Appendix B: The reverse reconciliation protocol 
1. Bob’s measurement 

We recall the statement of the operator Chernoff bound 
& Let {£t}t=i,...,T be a collection of i.i.d. operator-valued 
random variables, where each is a positive hermitian oper¬ 
ator in a Hilbert space of dimension D, satisfying < I and 
with mean value E[£t] = p > al for some a £ (0,1). Then 
for any e > 0 (and provided that (1 + e)p < 1) we have 

(B1) 

and 

-- Dexp ( _ S(|) ’ (B2) 

To define Bob’s POVM we apply this bound to the opera¬ 
tors 

ax, s) = P n B \p n {x, s))(/3 n (x, s)| P n B , (B3) 


r 0 (s) =I-^r 0 (s). (B6) 

X 

However, that the probability associated to the POVM element 
To(s) is negligibly small. Applying (IB 21 ) we obtain that 

^T X ( S )> l^~l-e 2 , (B7) 

X 

from which it follows Fq(s) < e 2 . 


2. Alice’s and Eve’s conditional states 

For the reverse reconciliation protocol it is easier to work 
in the Wigner function representation. 

In the first phase of the reverse reconciliation protocol the 
tripartite state p\\ BE = Pajbe ' s broadcast by Alice through 
the quantum channel, Pabe is the tensor product of n three¬ 
mode zero-mean Guassian states (for a review on Gaussian 
states see, e.g., [39|]). The Wigner function of pabe reads 

W(Rabe) = N exp (^—-HabeVXbe^- ~ABE ) , (B8) 

where R abe = (qA,PA, Qb,Pb, Qe,Pe) is the three-mode 
quadrature vector. The covariance matrix can be easily com¬ 
puted and reads: 
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( C 

0 

svv 

0 

6V 1 - V 

0 \ 


0 

c 

0 

-Sy/fj 

0 


1 

Syfn 

0 

Cp + (1 - p) 

0 

(C ~l)s/p(l-p) 

0 

2 

0 

-svv 

0 

Cp + (1 - p) 

0 

(C- l)y/p(l-p) 


6V1 - P 

0 

{c - l)\/p{l - p) 

0 

C(1 - p) + 7? 

0 


\ 0 

-Sy/T^fj 

0 

(C- 1) \Jp{0 -p) 

0 

C{l-p) + p J 


(B9) 

where C = 2 N + 1 and S = 2y/N(N + 1). From Vabe we obtain the covariance matrix of the joint state of Alice and Bob, 




/ c o s^q o 

0 C 0 -Sy/j 7 

s^q o Cr) + { i-n) o 

V o -Sy/rj 0 Crj + (1 — 77) 


and that of Eve and Bob, 

( Cp + (l-p) 


Vbe = 


1 


(BIO) 


0 (C-l)y/tfT=v) 0 _ \ 

0 _ Cr)+ (1 — 77 ) 0 (C — 1) y/ 77(1 — r?) 

(C - DyV 1 - v) 0 _ C(l-p)+p 0 

0 (C - l)y/p(l - p) 0 C(1 — p) + p ) 


(Bll) 


r 


In the second phase of the protocol Bob makes a measure¬ 
ment described by the POVM elements r x (s) (l30l >. To sim¬ 
plify the notation we drop the normalization factor and write 

r x (s) ~ P” |/3” (x, S))(p n ( x, s)|Ps . (B12) 

We compute Alice’s (not-normalized) conditional state: 

p n A (x,s) = TT B [P A ®A^pT B \ (B13) 

= Tt b \l A <g> P£ |/3”(*,s))(/3”(x, s)\F% p%\ . 

(B14) 

We apply the property of strong typicality, 
||P^ |/3”(x,s))(/3”(a;,s)|P^ - |/3”(x,s))(/3”(a;,s)|||i < <5, 
to obtain, up to an error smaller than <5 in trace distance, 

p n A {x, s) ~ Tr s [II <8. \P n (x, s))(P n (x, s)| p%\ (B15) 

n 

= (^)Tr B [I a ® \/3j(x,s))(/3j(x,s)\ p AB \ (B16) 
3=1 

n 

= ®P Aj (x,s). (B17) 

3=1 

Then the probability of the outcome ‘x’ can be obtained as 

p{x,s) = Tr [p A (x, s)]. 

In the Wigner function representation, the equation 

p Aj (x,s) = Tr s [I j4 <g) \P j (x,s))(/3 j (x,s)\ p AB ] reads 

W Aj ( x>s )(R A ) = {2n) n J d 2n R B W Pj ( x>s) (R B )W AB (R AB ), 

(B18) 

where W AB (R AB ) is the Wigner function of p AB and 
BP/3j(a;,s)(I3,s) i s the Wigner function of the coherent state 


|/3 j(x, s)}. With a lengthly but straightforward calculation we 
found that the Wigner function of p Aj (x, s ) is also Gaussian 
with covariance matrix 


j(x,s) 


(1 ~ pW 

1 + pN 



(B19) 


From V Aj ( X:S ) we can compute the von Neumann entropy 
of the conditional states p Aj (x, s), which is S(p A . (x, s)) = 
g[{ 1 — rj)N'] with N' = N/( 1 + pN). 

By applying the same reasoning we compute the covariance 
matrix of Eve’s conditional states p Bj (x, s ): 


VEj(x,s) 


(1 ~V)N 1 
1+pN 2 



(B20) 


We also compute the mean Rj = (q B , ■ PE0 and obtain 


fej(x,s) 


PEj(x,s) 


n Vp {I — 77) Re[pj(x,s)} 
1 + pN y/2 

N 4 / 17(1 ^ r/) lm[/3j(s,s)] 
1 + pN 4/2 


(B21) 

(B22) 


Notice that the mean is also a function of the mode label j 
through the amplitude 0j(x. s ). We remark that Alice’s and 
Eve’s conditional states have the same covariance matrix but 
different mean. 


3. Calculations for the security proof 

From the form of the conditional state p 1 ^(x,s) = 

®™ =1 p B . (x, s ) we can compute 

E s [p n E (x,s)\=p% n 


(B23) 
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(notice that, for how Bob’s measurement has been defined, the 
expectation value over s equals the expectation value over x). 
Pe is a Gaussian state with zero mean. Its covariance matrix 
can be obtained directly from (IB 11b and reads 


The spectral decomposition of pe is as in Eq. ( I A -H i. Similarly, 
the operator p E ® Pe is identical to its homologous analyzed 
for the direct reconciliation protocol, with spectral decompo¬ 
sition given in Eq. (IA 8 b . 


V E 


1 / C(1 — r])+T] 0 

2 \ 0 C( 1 - 77 ) + 17 


(1 -ri)N+ 1 - 



(B24) 

(B25) 


That is, pe is a thermal state with (1 — 77 ) N mean photons, 
whose entropy is <5 , (p(i_ ?? )iv) = ff[(l — v)N]. We then obtain 

We now consider the operator p2E = E s [pE :j (x. s) ® 
2 -n{g[(i-r l )N}+5] pn < pn p |n p „ < 2 - n [g[(i- v )N]-S] pn _ p Ej {x,s)]. Using the results of Sec. EH we found that p 2E 

(B26) is a Gaussian state with zero mean and covariance matrix 


J 


((l-ri)N + l 

0 

77(1 — r))NN' 

V 0 


0 

(1-7?)2V+i 

0 

77(1 — tj)NN' 


77(1 — r])NN' 

0 

(1 ~V)N+1 
0 


° \ 

77(1 - ri)NN' 

0 

(l-ri)N + \) 


(B27) 


with N' = N/{ 1 + 77TV). From the covariance matrix V 2E we 
compute the von Neumann entropy S(p 2 e) = <?[(1 — 77 )N'] + 
g[( 1 - 77 )N"], with N" = N{1 + 2pN)/(l + 77 N). Finally, 
its spectral decomposition is 

1 V ( V 

P2E (1 - 77 fN'N" t ^ Q V (1 - V)N' + 1 J 
( (I-77) N" \ m 

X V(1 _ ?7 )N" + 1 J I (B28) 

with 

I V’t.m) = ^ ^ (^j (-1 ) k ^(t + m-j-k)\ 

x \J ( j + k)\ \t + m - j - k)\j + k). (B29) 


Notice that \ipt,m) is a state with exactly £ = t + m photons. 
It follows that p 2 E commutes with p E ® Pe (see Eq. ( IA 8 b ). 


4. Active attack 

An active Gaussian attack from the eavesdropper can be 
modeled as a beam-splitter that mixes the mode from Alice 
with a mode from a two-mode entangled state. As shown in 
Fig. [ 6 ] the eavesdropper Eve obtains both the modes of the 
two-mode entangled state. In this setting, if Alice’s two-mode 
entangled state has N mean photons per mode, and Eve’s two¬ 
mode entangled state has Nt mean photons per mode, then 
the joint four-mode Gaussian state of Alice, Bob and Eve has 
covariance matrix: 


J 


Vabee' — 



( ° 

0 

Sy/V 

0 

Sy/T^j 

0 

0 

0 \ 


0 

c 

0 

-Sy/rj 

0 

-SyfTN] 

0 

0 


Sy/V 

0 

Ct(1 — v) + Ct? 

0 

(C-C T )Vv( 1-17) 

0 

—<5Y\/1 — 

r? 0 

1 

0 

-Sy/rj 

0 

Ct( 1 — r?) + Cr? 

0 

(C-Ct)V r?(l-r?) 

0 

StV 1 - V 

2 

SVT=7j 

0 

(C - CrWvd - 7?) 

0 

C( 1 — t?) + Ctv 

0 

StV 

0 


0 

-•Vi - V 

0 

(C - C T ) V( 1 - V) 

0 

C(1 — 77) + C T V 

0 

—S T V 


0 

0 

—St\/ 1 — V 

0 

St V 

0 

Ct 

0 


V 0 

0 

0 

6’ T \/i - 77 

0 

-S T y/V 

0 

Ct / 


(B 30 ) 


where C = 2 N + 1, S = 2^/N(N + 1), and Ct = 2Nr + 1, instead of ( lB9b and repeat the calculations done in subsections 

St = 2^/Nt(Nt + 1). We can use this covariance matrix 
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OO 



Eve 


FIG. 6: A scheme for an active Gaussian attack. The beam splitter 
mixes Alice’s mode with one mode from an entangled pair (denoted 
by the symbol ‘oo’). The eavesdropper Eve obtains both the modes 
of the two-mode state. 


IB UB 3l for the reverse reconciliation protocol. We obtain 


For 5-typical type we have small fluctuation of S around its 
average, that is, 

OO OO 

AS = - ^2 TTf, log -Kt + ^2 ne log G [— c<5, c5]. (C3) 

£=o e=o 

From (1C I l i we obtain 

S = log [(1 - V )N + 1 ] 

- lo s( (l-~)W+l )< t >>-<'° g < <,+ 1 »». <C4> 


Xrr = g{N) - <?[(! - T])N} , (B31) which yields 


with N = N( 1 + A^r)/[1 + Nt — {N — and, for 

N 1, Nt, 

hr = g{N T ) + 2g[(l - r/)N + r]N T \ - g[( 1 - r))N} - ^[A], 

(B32) 

with N = 2(1 — r])N + C 1- 2 3 4 5 6 7 8 ' -1 ) _ Finally, in the limit 
N —> oo we obtain 

hr = Xrr - fc r r = 1 + log “ 9( N t) ■ (B33) 


AS = — log 


(1 - T))N 
(l-r])N + l 


For N large enough we have 


A(0 — A (log {t + 1)). 

(C5) 


AS — log e 


AW 

(1 - rf)N 


AW 

(l-rj)N + l 


(C 6 ) 


where we have used the fact that W* fluctuates about (1 — 
r])N. Finally we obtain 


Appendix C: Fluctuations of the mean photon number A(£) 

Let us consider the distribution n, with 


log e AW 
(1 - 77)JV 


[(1 — 77 ) iV + 1]A5. 


(C7) 


7 re 


1 

(l-r?)JV + l 


V (1 — v)N + 1/ 


(^ + 1 ), 


(Cl) 


Since for N large enough /3 = we have 


and a 5-typical type n. The empirical entropy given by 7 r is 

OO 

S = - 7 T£ log n e . (C2) 

r=o 


/3A(f) - [(1 — r])N + 1]A5. 


(C 8 ) 
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